Yes ImpEx also allows inports from SMF:
SMF
the latest supported version is documented as 1.1.4, but unless there have been major database changes in SMF since that version, it should work. You can also check on the vBulletin.com
vBulletin Impex Import System forum on experiences of other users regarding a SMF import.
vBulletin itself has a very good track record regarding vulnerabilities. If a possible vulnerability is discovered it is mostly patched within a day after it was confirmed. Being hacked thru a portal is not something vBulletin can change as the portal is not writen by us.